CVE-2026-6477
PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
En bref
- Sévérité
- HIGH 8.8
- EPSS
- EPSS 0.45 % · centile 39 (2026-10-27)
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- PostgreSQL
- Statut NVD
- Modified
Description
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | PostgreSQL |
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H | redhat-SADP |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary) |
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Faiblesses (CWE)
Références européennes
- ENISA EUVD · EUVD-2026-30283
- GCVE · GCVE-0-2026-6477
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1366 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1249 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1067 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1056 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0962 — Multiples vulnérabilités dans les produits Tenable · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0905 — Multiples vulnérabilités dans Tenable Security Center · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0816 — Multiples vulnérabilités dans Stormshield Management Center · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0788 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0612 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0595 — Multiples vulnérabilités dans PostgreSQL · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*< 14.23cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 15.0 < 15.18cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 16.0 < 16.14cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 17.0 < 17.10cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*≥ 18.0 < 18.4
Produits affectés
| Produit | Versions |
|---|---|
| PostgreSQL | affected 18 < 18.4 ; affected 17 < 17.10 ; affected 16 < 16.14 ; affected 15 < 15.18 ; affected 0 < 14.23 |
Références
- https://www.postgresql.org/support/security/CVE-2026-6477/
- https://access.redhat.com/security/cve/CVE-2026-6477
- https://bugzilla.redhat.com/show_bug.cgi?id=2477442
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6477.json
- https://access.redhat.com/errata/RHSA-2026:49521
- https://access.redhat.com/errata/RHSA-2026:50863
- https://access.redhat.com/errata/RHSA-2026:27718
- https://access.redhat.com/errata/RHSA-2026:44391
- https://access.redhat.com/errata/RHSA-2026:27743
- https://access.redhat.com/errata/RHSA-2026:27742
- https://access.redhat.com/errata/RHSA-2026:27738
- https://access.redhat.com/errata/RHSA-2026:28999
- https://access.redhat.com/errata/RHSA-2026:28208
- https://access.redhat.com/errata/RHSA-2026:26181
- https://access.redhat.com/errata/RHSA-2026:28143
- https://access.redhat.com/errata/RHSA-2026:44420
- https://access.redhat.com/errata/RHSA-2026:34362
- https://access.redhat.com/errata/RHSA-2026:34363
- https://access.redhat.com/errata/RHSA-2026:47090
- https://access.redhat.com/errata/RHSA-2026:29815
- https://access.redhat.com/errata/RHSA-2026:32994
- https://access.redhat.com/errata/RHSA-2026:35880
- https://access.redhat.com/errata/RHSA-2026:34043
- https://access.redhat.com/errata/RHSA-2026:42555
- https://access.redhat.com/errata/RHSA-2026:26561
- https://access.redhat.com/errata/RHSA-2026:49908
- https://access.redhat.com/errata/RHSA-2026:33497
- https://access.redhat.com/errata/RHSA-2026:29953
- https://access.redhat.com/errata/RHSA-2026:49909
- https://access.redhat.com/errata/RHSA-2026:33441
- https://access.redhat.com/errata/RHSA-2026:26524
- https://access.redhat.com/errata/RHSA-2026:29904
- https://access.redhat.com/errata/RHSA-2026:50779
- https://access.redhat.com/errata/RHSA-2026:32983
- https://access.redhat.com/errata/RHSA-2026:26525
- https://access.redhat.com/errata/RHSA-2026:29212
- https://access.redhat.com/errata/RHSA-2026:44308
- https://access.redhat.com/errata/RHSA-2026:28037
- https://access.redhat.com/errata/RHSA-2026:26203
- https://access.redhat.com/errata/RHSA-2026:26204
- https://access.redhat.com/errata/RHSA-2026:27741
- https://access.redhat.com/errata/RHSA-2026:54760
- https://access.redhat.com/errata/RHSA-2026:21182
- https://access.redhat.com/errata/RHSA-2026:22878
- https://access.redhat.com/errata/RHSA-2026:44481
- https://access.redhat.com/errata/RHSA-2026:58981
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |